Give your email its own password, and don't reuse it on any website

High value
Evidence C
Saves money
Free
Takes minutes
Some willpower

In plain words

A password stolen from another website gets used to log straight into your email. Once someone is in your email, every account that can reset its password by email goes down with it. So give your email its own password and use it nowhere else.

Cost: Free. If you keep passwords in a password manager, you don't have to remember them. The hard part is breaking the old habit of using one password everywhere.
What you get: Taking account names and passwords leaked from somewhere else and trying them one by one is called credential stuffing (撞库). It is the easiest kind of attack, and your email will be tried this way too. Once someone gets into your email, every account that resets its password through it is lost together. The advice of the U.S. Cybersecurity and Infrastructure Security Agency is: use a different strong password for every account, at least 16 characters, and keep them in a password manager.
Notes: If you can't remember them, use the password manager built into your browser. It remembers each website's password for you, which is far better than using the same one everywhere. Don't keep passwords in WeChat Favorites or a notes app.
Evidence grade: C : The author's experience or common practice, without direct literature.
Sources: US CISA. Use Strong Passwords. https://www.cisa.gov/secure-our-world/use-strong-passwords

Translated from the Chinese original. Original book, section 14, tip 2. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer